Choosing safe-cli's blockchain or tx-service when interacting with a recovered L2 Safe

Question

We have a 2 of 3 Safe on Ethereum Mainnet:

https://app.safe.global/balances?safe=eth:0x8CB6e8190e6BB575a27497AdCB74f8b99D285DED

USDC was transferred to that address on Base. To recover the tokens, we:

1. Manually replayed the Safe deploy tx on Base: https://basescan.org/tx/0x60f2f386418e8f82d52b839dfc8e61d0c19291f28da682a9a800c53792a982cd
2. Created a transaction in the Safe UI to distribute the tokens.
3. The Safe UI didn't allow us to execute the transaction. So we executed it by calling execTransaction via BaseScan: https://basescan.org/tx/0xae416635bf2958c57232d854ba0e557e6b926106c76cc5911938a54574590491

The Safe on Base is here:

https://app.safe.global/balances?safe=base:0x8CB6e8190e6BB575a27497AdCB74f8b99D285DED

Now with more USDC in the Safe and a nonce of 1, we are trying to repeat steps 2-3.

However the Safe UI won't allow us to create the transaction (step 2).

To bypass the UI I have connected to the Safe via safe-cli.

I have some questions about safely interacting with a recovered Safe via the safe-cli:

1. In blockchain mode, update_to_l2 requires nonce to be 0. Are there any other situations for a recovered Safe where nonce must be 0? I'm wondering if this is why we are not able to create the transaction in the UI now, since nonce is 1, even though we were able to do it previously (step 2 above) when nonce was 0.
2. In blockchain mode, how does send_erc20 work if the threshold is greater than 1? Since the tx won't show as pending in the Safe UI, will we be able to approve it via BaseScan as we did in step 3 above?
3. Does send_erc20 return the SafeTxHash? https://github.com/safe-global/safe-cli/blob/main/safe_cli/operators/safe_operator.py#L553
4. What is the difference between approve_hash and sign-tx?

Thanks in advance!

Answer 1

That version of the Safe Master Contract is not supported in other networks other than mainnet and gnosis chain (as it requires a tracing node for indexing), so service cannot index transactions.

1. Nonce must be 0 as if nonce is higher we cannot know what's the current status of the Safe, so we will not index it
2. You need to load at least threshold owners in the Safe-CLI to be able to run the transaction
3. It prints the txHash when executed
4. Approve_hash does it onchain, and sign_tx is only available in tx-service mode and it pushes the transaction to the tx service

Even if service is not able to index transactions for your Safe you should be able to use the tx-service mode to propose new transactions and gather the required signatures, but it will never appear as executed in the interface